Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM RegistryBooster.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM rbmonitor.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM rbnotifier.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM move_serial.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM rb_move_serial.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM rb_track_install.exe
Modifies file system
Creates the following files
- %TEMP%\mia4b5.tmp\data\offline\24a335ff\f45c8718\settings.ini
- %TEMP%\mia1\registrybooster.mtx
- %TEMP%\mia1\shared.translations.chinese (prc)
- %TEMP%\mia1\shared.translations.chinese (taiwan)
- %TEMP%\mia1\shared.translations.danish
- %TEMP%\mia1\shared.translations.dutch
- %TEMP%\mia1\progress.dfm
- %TEMP%\mia1\progressprereq.dfm
- %TEMP%\mia1\shared.translations.english
- %TEMP%\mia1\shared.translations.german
- %TEMP%\mia1\shared.translations.greek
- %TEMP%\mia1\shared.translations.italian
- %TEMP%\mia1\shared.translations.japanese
- %TEMP%\mia1\shared.translations.map
- %TEMP%\mia1\shared.translations.finnish
- %TEMP%\mia1\shared.translations.french
- %TEMP%\mia1\licensecheck.dfm
- %TEMP%\mia1\index.swedish.htm
- %TEMP%\mia1\shared.translations.original
- %TEMP%\mia1\index.english.htm
- %TEMP%\mia1\index.finnish.htm
- %TEMP%\mia1\index.french.htm
- %TEMP%\mia1\index.german.htm
- %TEMP%\mia1\index.greek.htm
- %TEMP%\mia1\index.italian.htm
- %TEMP%\mia1\index.japanese.htm
- %TEMP%\mia1\index.norwegian.htm
- %TEMP%\mia1\index.polish.htm
- %TEMP%\mia1\index.portugese (brazil).htm
- %TEMP%\mia1\index.portugese (portugal).htm
- %TEMP%\mia1\index.russian.htm
- %TEMP%\mia1\index.spanish.htm
- %TEMP%\mia1\shared.translations.norwegian
- %TEMP%\mia1\index.danish.htm
- %TEMP%\mia1\index.turkish.htm
- %TEMP%\mia4b5.tmp\data\offline\d038292b\57fa2e68\messages.mo
- %TEMP%\mia1\shared.translations.polish
- %TEMP%\mia1\translations.original
- %TEMP%\mia1\translations.polish
- %TEMP%\mia1\translations.portugese (brazil)
- %TEMP%\mia1\translations.portugese (portugal)
- %TEMP%\mia1\translations.russian
- %TEMP%\mia1\translations.spanish
- %TEMP%\mia1\translations.swedish
- %TEMP%\mia1\translations.turkish
- %TEMP%\mia1\uniblue registrybooster.mtx
- %TEMP%\mia1\uninstallationfinish.dfm
- %TEMP%\mia1\uninstallationprogress.dfm
- %TEMP%\mia1\welcome.dfm
- %TEMP%\mia1\flash.ocx
- %TEMP%\mia1\installerextensions.dll
- %TEMP%\mia1\mexefunc.dll
- %TEMP%\mia1\translations.norwegian
- %TEMP%\mia1\index.chinese (taiwan).htm
- %TEMP%\mia1\index.dutch.htm
- %TEMP%\mia1\translations.italian
- %TEMP%\mia1\shared.translations.portugese (portugal)
- %TEMP%\mia1\shared.translations.russian
- %TEMP%\mia1\shared.translations.spanish
- %TEMP%\mia1\shared.translations.swedish
- %TEMP%\mia1\shared.translations.turkish
- %TEMP%\mia1\startinstallation.dfm
- %TEMP%\mia1\translations.chinese (prc)
- %TEMP%\mia1\translations.chinese (taiwan)
- %TEMP%\mia1\translations.danish
- %TEMP%\mia1\translations.dutch
- %TEMP%\mia1\translations.english
- %TEMP%\mia1\translations.finnish
- %TEMP%\mia1\translations.french
- %TEMP%\mia1\translations.german
- %TEMP%\mia1\translations.greek
- %TEMP%\mia1\translations.japanese
- %TEMP%\mia1\shared.translations.portugese (brazil)
- %TEMP%\mia1\index.chinese (prc).htm
- %TEMP%\mia1\icon.ico
- %TEMP%\mia1\destination.dfm
- %TEMP%\mia4b5.tmp\data\offline\d038292b\3f11d5be\dk.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\5b07c260\en.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\6cf41bae\es.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\a143bdab\fi.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\f6d2c254\fr.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\9e32a01c\gr.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\dbd9b16a\installerextensions.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\12d7f711\it.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\db6d4af1\jp.dll
- %TEMP%\mia4b5.tmp\data\offline\midefunc.dll\mexefunc.dll
- %TEMP%\mia4b5.tmp\data\offline\mmsi.dll\mmsiexec.dll
- %TEMP%\mia4b5.tmp\data\offline\14674720\a524f6bd\msvcp90.dll
- %TEMP%\mia4b5.tmp\data\offline\14674720\a524f6bd\msvcr90.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\147fc130\br.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\dbd9b16a\rb_ubm.exe
- %TEMP%\mia4b5.tmp\data\offline\d038292b\bef5101e\de.dll
- %TEMP%\mia1\mmsiexec.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\7dbeb094\nl.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\dbd9b16a\rb_move_serial.exe
- %TEMP%\mia4b5.tmp\data\offline\d038292b\dbd9b16a\repair_transform.xsl
- %TEMP%\mia4b5.tmp\data\offline\d038292b\41eb15e7\cwebpage.dll.html
- %TEMP%\mia4b5.tmp\data\offline\d038292b\41eb15e7\comtypes.txt
- %TEMP%\mia4b5.tmp\data\offline\d038292b\41eb15e7\decorator.py.txt
- %TEMP%\mia4b5.tmp\data\offline\d038292b\41eb15e7\ordereddict.py.txt
- %TEMP%\mia4b5.tmp\data\offline\d038292b\41eb15e7\py2exe.txt
- %TEMP%\mia4b5.tmp\data\offline\14674720\a524f6bd\microsoft.vc90.crt.manifest
- %TEMP%\mia4b5.tmp\data\offline\d038292b\41eb15e7\python-changes.txt
- %TEMP%\mia4b5.tmp\data\offline\d038292b\41eb15e7\simplejson.txt
- %TEMP%\mia4b5.tmp\data\offline\d038292b\41eb15e7\wmi.txt
- %TEMP%\mia4b5.tmp\bm_installer.exe
- %TEMP%\mia4b5.tmp\data\offline\d038292b\dbd9b16a\launcher.exe
- %TEMP%\mia4b5.tmp\data\offline\d038292b\dbd9b16a\rbmonitor.exe
- %TEMP%\mia4b5.tmp\data\offline\d038292b\dbd9b16a\rbnotifier.exe
- %TEMP%\mia4b5.tmp\data\offline\d038292b\41eb15e7\python.txt
- %TEMP%\mia4b5.tmp\data\offline\d038292b\dbd9b16a\registrybooster.exe
- %TEMP%\mia1\translations.map
- %TEMP%\mia4b5.tmp\data\offline\d038292b\8779dfbb\no.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\3bac9daf\ru.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\ff98bde1\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\82c7b32\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\98c1490\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\51025de4\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\6f5a5c6b\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\975f7f3d\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\fc168624\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\54083bf\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\ab0797ad\messages.mo
- %TEMP%\mia4b5.tmp\bm_installer.res
- %TEMP%\lang.loc
- %TEMP%\mia1\installaware.png
- %TEMP%\mia.tmp
- %TEMP%\mia1\confirmuninstallation.dfm
- %TEMP%\mia4b5.tmp\data\offline\d038292b\d0e87741\pl.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\c96fc1ed\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\a46ae25f\pt.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\ab37faec\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\dbd9b16a\cwebpage.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\f4c879d5\se.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\9e452c1\tr.dll
- %TEMP%\mia4b5.tmp\data\offline\vlddrvideplug.dll\vlddrvexeplug.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\7d7a217b\xs.dll
- %TEMP%\mia4b5.tmp\data\offline\d038292b\32df9203\xt.dll
- %TEMP%\mia4b5.tmp\mia.lib
- %TEMP%\mia4b5.tmp\data\offline\d038292b\dbd9b16a\intermediate_views.dat
- %TEMP%\mia4b5.tmp\data\offline\d038292b\dbd9b16a\library.dat
- %TEMP%\mia4b5.tmp\data\offline\d038292b\dbd9b16a\views.dat
- %TEMP%\mia4b5.tmp\data\offline\d038292b\983f7b0e\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\c1e0d6f7\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\20d9f0dc\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\2e0de6a5\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\47bf4054\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\7eb94ea0\messages.mo
- %TEMP%\mia4b5.tmp\data\offline\d038292b\191fd45a\messages.mo
- %TEMP%\mia1\vlddrvexeplug.dll
Deletes the following files
- %TEMP%\lang.loc
- %TEMP%\mia.tmp
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'TApplication' WindowName: 'bm_installer'
Creates and executes the following
- '%TEMP%\mia4b5.tmp\bm_installer.exe' /m="<Full path to file>" /k=""
- '%WINDIR%\syswow64\taskkill.exe' /F /IM RegistryBooster.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM rbmonitor.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM rbnotifier.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM move_serial.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM rb_move_serial.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM rb_track_install.exe' (with hidden window)